gstreamer vulnerabilities and threats

A stack-based buffer overflow vulnerability exists in GStreamer's gst_opus_dec_parse_header function in gstopusdec.c. The vulnerability occurs because the pos array, a stack-allocated buffer of size 64, can be overflowed if the n_channels value exceeds 64, leading to writes beyond the buffer boundary. This can overwrite the instruction pointer (EIP) on the stack. The issue is fixed in version 1.24.10.

CVE-2024-47606 is a high-severity integer underflow vulnerability in the GStreamer media-handling library. It occurs in the qtdemux_parse_theora_extension function, where an integer underflow causes an incorrect large size value to be used for memory allocation. This leads to a buffer overflow that overwrites critical memory structures, potentially allowing an attacker to hijack function pointers and execute arbitrary code. The issue is fixed in GStreamer version 1.24.10.

A null pointer dereference vulnerability exists in GStreamer's gst_matroska_demux_update_tracks function due to improper handling of invalid caps values. This flaw can cause a null pointer dereference when gst_buffer_get_size attempts to access a size field via a null pointer. The issue is resolved in version 1.24.10.

A null pointer dereference vulnerability exists in GStreamer's gst_matroska_demux_add_wvpk_header function in matroska-demux.c. The function fails to validate the stream->codec_priv pointer before dereferencing it, which can cause the application to crash if this pointer is NULL. This issue is resolved in version 1.24.10.

A null pointer dereference vulnerability exists in GStreamer's gst_matroska_demux_parse_blockgroup_or_simpleblock function. This occurs because the function does not properly validate the GstBuffer *sub pointer before dereferencing it. The issue is fixed in version 1.24.10.

CVE-2024-47600 is an out-of-bounds read vulnerability in GStreamer's gst-discoverer component. The flaw occurs in the format_channel_mask function due to an array of fixed size 64 being accessed with an index potentially greater than 63. This happens because gst_discoverer_audio_info_get_channels can return a channel count exceeding 64, leading to reading unintended stack bytes and possible memory corruption. The issue is fixed in version 1.24.10.

A null pointer dereference vulnerability exists in the gst_jpeg_dec_negotiate function of GStreamer prior to version 1.24.10. The function fails to check for a NULL return from gst_video_decoder_set_output_state, leading to a potential segmentation fault and Denial of Service (DoS). This issue is fixed in version 1.24.10.

CVE-2024-47598 is an out-of-bounds read vulnerability in the GStreamer multimedia framework. It occurs in the qtdemux_merge_sample_table function due to improper bounds checking of the stts buffer, allowing reading 4 bytes beyond the allocated memory. This flaw is fixed in version 1.24.10.

CVE-2024-47597 is an out-of-bounds read vulnerability in the GStreamer multimedia framework. It occurs in the qtdemux_parse_samples function of qtdemux.c, where the function reads up to 8 bytes beyond the boundary of the stream->stco buffer. This flaw is fixed in version 1.24.10.

CVE-2024-47596 is an out-of-bounds read vulnerability in the GStreamer media-handling library. It occurs in the qtdemux_parse_svq3_stsd_data function when processing certain input data, leading to reading beyond the buffer boundary. This can cause the process to read up to 4GB of memory or crash due to segmentation faults. The issue is fixed in version 1.24.10.

CVE-2024-47546 is an integer underflow vulnerability in the GStreamer media-handling library, specifically in the extract_cc_from_data function within qtdemux.c. The flaw occurs when a subtraction operation atom_length - 8 underflows if atom_length is less than 8, causing an out-of-bounds read via g_memdup2. This vulnerability is fixed in version 1.24.10.

CVE-2024-47545 is an integer underflow vulnerability in the GStreamer media-handling library, specifically in the qtdemux_parse_trak function. The flaw occurs during strf parsing when a subtraction operation reduces a size variable by 40, potentially causing a negative integer underflow. This leads to an out-of-bounds read when gst_buffer_fill calls memcpy with an incorrect large size. The issue is fixed in version 1.24.10.

A null pointer dereference vulnerability exists in the qtdemux_parse_sbgp function of the GStreamer media-handling library. This flaw can lead to a denial of service or application crash. The issue is resolved in version 1.24.10.

CVE-2024-47543 is an out-of-bounds read vulnerability in the GStreamer multimedia framework, specifically in the qtdemux_parse_container function. The flaw arises because the length value is not properly validated, allowing a pointer to exceed buffer boundaries. This can lead to reading up to 4GB of process memory or cause a segmentation fault. The issue is fixed in version 1.24.10.

A null pointer dereference vulnerability exists in GStreamer's id3v2_read_synch_uint function in id3v2.c. If called with a null frame_data pointer, it causes a segmentation fault leading to denial of service. This issue is fixed in version 1.24.10.

CVE-2024-47541 is an out-of-bounds write vulnerability in GStreamer's gst_ssa_parse_remove_override_codes function, which parses SSA style override codes. The flaw occurs when a closing curly bracket appears before an opening one, causing memmove() to write beyond allocated memory. This issue is fixed in version 1.24.10.

CVE-2024-47540 is a high-severity vulnerability in GStreamer, a media-handling library. It involves an uninitialized stack variable in the gst_matroska_demux_add_wvpk_header function. When a certain size condition is met, an uninitialized variable is used in a buffer unmap operation, leading to a function pointer hijack. This flaw could allow an attacker to hijack execution flow and potentially execute arbitrary code. The issue is fixed in GStreamer version 1.24.10.

CVE-2024-47539 is a high-severity out-of-bounds write vulnerability in the GStreamer media-handling library. It occurs in the convert_to_s334_1a function within isomp4/qtdemux.c due to a mismatch between allocated memory size and loop bounds when ccpair_size is even. This flaw allows overwriting up to 3 bytes beyond the allocated storage array. The issue is fixed in version 1.24.10.

A stack-based buffer overflow vulnerability exists in GStreamer's vorbis decoder component in the function vorbis_handle_identification_packet. The overflow occurs when the number of audio channels exceeds 64, causing writes beyond a fixed-size stack buffer. This can overwrite critical stack data including the instruction pointer and the GstAudioInfo structure. The issue is fixed in version 1.24.10.

CVE-2024-47537 is a high-severity vulnerability in GStreamer prior to version 1.24.10. It involves an out-of-bounds write caused by an integer overflow when reallocating memory for media samples. The vulnerability occurs because the samples_count value is read from an input file and can be large enough to cause an integer overflow during memory allocation, leading to insufficient memory being allocated. Subsequent writes exceed the allocated buffer, causing memory corruption. This flaw has been fixed in GStreamer version 1.24.10.